PT-2018-5238 · Poco+1 · Poco C++ Libraries+1

Stephan Zeisberg

·

Publicado

2018-01-03

·

Atualizado

2024-04-05

·

CVE-2017-1000472

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions POCO C++ Libraries versions prior to 1.8
Description The issue concerns a "file path injection vulnerability" in the ZipCommon::isValidPath() function, which does not properly restrict the filename value in the ZIP header. This allows attackers to conduct absolute path traversal attacks during ZIP decompression, potentially creating or overwriting arbitrary files via a crafted ZIP file.
Recommendations For versions prior to 1.8, update to version 1.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of ZIP files from untrusted sources to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2017-3590
ALT-PU-2019-2751
CVE-2017-1000472
DLA-1239-1
DSA-4083-1

Produtos afetados

Alt Linux
Poco C++ Libraries